v0.1.7

Fixes

• Fix MCP tools not visible to agents (threshold was >= 3, now > 0)
• MCP tools now show in Settings -> Tools alongside built-in tools
• Fix cron scheduler firing every 60s (real cron parsing with cron crate)
• Fix token quota treating 0 as deny-all instead of unlimited
• Fix dashboard scheduler calling wrong API endpoint
• Fix base_url not propagated from config to LLM driver
• Fix Mastodon HTML sanitizer panic on emoji/CJK characters
• Expand SSRF blocklist (Alibaba/Azure metadata, IPv6 localhost, 0.0.0.0)
• Add vault OFV1 magic byte header with legacy JSON backward compat
• Add input length validation for agent fields (413 on overflow)

New

• Zhipu Coding (CodeGeeX) provider + codegeex-4 model
• Config-based OAuth client ID overrides ([oauth] section)